Improper Neutralization of Special Elements Used in a Template Engine

Description The Microweber application allows HTML tags in the "Blog Comments" which can be exploited by Injecting HTML payloads. Proof of Concept 1.Open any blog in which comment is allowed. 2.Insert your html code in code block. e.g., Hurry Up!Go to https://evil.com and get free $1000 in your...

CVE-2022-0855

Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcsplugin prior to 0.0.4...

Input validation

Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcsplugin prior to 0.0.4...

CVE-2022-0855 Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin

Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcsplugin prior to 0.0.4...

CVE-2022-0855

CVE-2022-0855 affects microweber-dev/whmcs_plugin prior to version 0.0.4. The root cause is an improper resolution of path equivalence in the plugin, which can enable an open redirect or misrouting of a request. Exploitation details in the connected records describe an open-redirect scenario that...

Microweber Email Bombing Vulnerability

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An email bombing vulnerability exists in versions of Microweber prior to 1.3. The vulnerability stems from a failure to ra...

Authentication Bypass

microweber/microweber is vulnerable to authentication bypass. The vulnerability exists in auth.php because the password reset is not handled properly which allows an attacker to send unlimited email to any mail address...

GHSA-7R79-MRP6-8MHQ Rate limit missing in microweber

Microweber prior to version 1.3 does not rate limit password reset emails...

Rate limit missing in microweber

Microweber prior to version 1.3 does not rate limit password reset emails...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

Default credentials

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777 Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3...

CVE-2022-0777

CVE-2022-0777 affects microweber/microweber prior to version 1.3. The issue is a weak password recovery mechanism caused by a missing rate limit on password reset emails, as described by the connected advisories (e.g., GHSA-7R79-MRP6-8MHQ and related Red Hat/NVD entries). The documented impact is...

Microweber logic flaw vulnerability

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A logic flaw vulnerability exists in Microweber, which stems from an error in the business...

Microweber 授权问题漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. An email bombing vulnerability exists in versions of Microweber prior to 1.3. The vulnerability stems from a failure to ra...

microweber cross-site scripting vulnerability (CNVD-2022-15526)

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber, which stems from the lack of prope...

Microweber Cross-Site Scripting Vulnerability (CNVD-2022-15527)

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in GitHub, which stems from the lack of proper...

Business Logic Errors

microweber/microweber is vulnerable to business logic errors. The vulnerability exists in updatecart function of CartManager.php due to missing validations which allows an attacker to exploit the flaw...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the Edit source option in the endpoint URL by navigating to the malicious URLs...